Application No. 10/685,472 
Response Filed 06/26/2008 
Reply to Office Action of 03/28/2008 

Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (currently amended) A method for monitoring a process, the method 

comprising: 

creating a signature representative of the process; 
continuously updating the created signature; and 

detecting abnormalities based upon the continuously updated 
signature[[.]L 

wherein the process is related to usage of networked computing devices in 
a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

2. (Original) The method of claim 1, wherein creating a signature comprises 
calculating an average and a standard deviation. 

3. (Original) The method of claim 2, wherein creating a signature comprises 
accelerated learning through incrementally increasing a learning responsiveness ratio. 

4. (Original) The method of claim 2, wherein creating a signature comprises 
initially repeating a running average and standard deviation through a plurality of intervals. 
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5. (Original) The method of claim 1, wherein updating the created signature 
comprises using a weighting factor to ensure that recently recorded data has a greater impact 
than older data. 

6. (Original) The method of claim 1, wherein updating the created signature 
comprises utilizing a moving average over a time to account for events occurring at unexpected 
times. 

7. (Original) The method of claim 1, wherein detecting abnormalities 
comprises determining if measured values are above an upper threshold or below a lower 
threshold. 

8. (Original) The method of claim 1, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

9. (currently amended) A computer readable storage medium having 
computer executable instructions for performing the method of claim 1 . 

10. (currently amended) A method for detecting abnormalities occurring 
during a process based upon a continuously updated signature representative of the process, the 
method comprising: 

continuously monitoring a system parameter; 

computing a normal range of values for the system parameter based on the 
continuously updated signature; 

determining if the monitored system parameter is within the normal range; 

and 
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indicating existence of an abnormality if the monitored system parameter 
is outside of the normal range[[.]L 

wherein the process is related to usage of networked computing devices in 
a datacenter. 

11. (Original) The method of claim 10, further comprising creating a signature 
by calculating an average and a standard deviation. 

12. (Original) The method of claim 11, wherein creating a signature comprises 
accelerated learning through incrementally increasing a learning responsiveness ratio. 

13. (Original) The method of claim 1 1 , wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 

14. (Original) The method of claim 10, wherein computing a normal range of 
values comprises using a weighting factor to ensure that recently recorded data has a greater 
impact than older data. 

15. (Original) The method of claim 10, wherein computing a normal range of 
values comprises utilizing a moving average over a time to account for events occurring at 
unexpected times. 

16. (Original) The method of claim 10, wherein determining whether a 
monitored system parameter is within a normal range of values comprises determining if 
monitored system parameters are above an upper threshold or below a lower threshold. 
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17. (Original) The method of claim 16, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

18. (currently amended) A computer readable storage medium having 
computer executable instructions for performing the method of claim 10. 

19. (currently amended) A method for creating a signature useful for detecting 
abnormalities in a computing system environment, the method comprising: 

setting a learning responsiveness ratio; 
monitoring a system parameter; 

adjusting the learning responsiveness ratio at fixed intervals until a desired 
value is reached; 

calculating an average and standard deviation for each interval; 

using the average, standard deviation and learning responsiveness ratio to 
create the signature[[.]] i 

wherein the abnormalities in the computing system environment relate to 
usage of networked computing devices in a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

20. (Original) The method of claim 19, further comprising continuously 
updating the created signature. 

21. (Original) The method of claim 20, further comprising detecting 
abnormalities based on the updated signature. 
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22. (Original) The method of claim 19, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 

23. (Original) The method of claim 20, wherein updating the created signature 
comprises using a weighting factor to ensure that recently recorded data has a greater impact 
than older data. 

24. (Original) The method of claim 20, wherein updating the created signature 
comprises utilizing a moving average over a time to account for events occurring at unexpected 
times. 

25. (Original) The method of claim 21, wherein detecting abnormalities 
comprises determining if measured values are above an upper threshold or below a lower 
threshold. 

26. (Original) The method of claim 21, further comprising calculating upper 
and lower threshold limits based on jitter offset. 

27. (currently amended) A computer readable storage medium having 
computer executable instructions for performing the method of claim 19. 

28. (currently amended) A computerized system including computer storage 
medium for detecting abnormal activity in a computerized environment, the system comprising: 

monitoring tools for continuously monitoring a system parameter; 
a continuously updated signature representative of normal values of the 
system parameter; and 
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an abnormality indicator calculated based on the continuously updated 
signature, the abnormality indicator including a range of normal values for the 
system parameter^.]]., 

wherein the abnormal activity is related to abnormal usage of networked 
computing devices in a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

29. (Original) The system of claim 28, wherein the continuously updated 
signature comprises an average and a standard deviation. 

30. (Original) The system of claim 28, wherein the continuously updated 
signature comprises a weighting factor to ensure that recently recorded data has a greater impact 
than older data. 

31. (Original) The system of claim 28, wherein the continuously updated 
signature comprises a moving average over time to account for events occurring at unexpected 
times. 

32. (Original) The system of claim 28, wherein the abnormality indicator 
determines whether a monitored system parameter is within a normal range of values and 
whether monitored system parameters are above an upper threshold or below a lower threshold. 

33. (Original) The method of claim 28, wherein the abnormality indicator 
calculates upper and lower threshold limits based on jitter offset. 
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34. (currently amended) A computerized monitoring system including 
computer storage medium for monitoring a process, the monitoring system comprising: 

a signature creation module for creating a signature representative of the 
process; 

a signature updating module for continuously updating the created 
signature; and 

an abnormality detection module for detecting abnormalities based upon 
deviations from the updated signature^.]]., 

wherein the process is related to usage of networked computing devices in 
a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

35. (Original) The system of claim 34, wherein the signature creation module 
includes tools for calculating an average and a standard deviation. 

36. (Original) The system of claim 35, wherein the signature creation module 
comprises tools for performing accelerated learning through incrementally increasing a learning 
responsiveness ratio. 

37. (Original) The system of claim 35, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 
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38. (Original) The system of claim 34, wherein the signature updating module 
comprises a weighting factor to ensure that recently recorded data has a greater impact than older 
data. 

39. (Original) The system of claim 34, wherein the signature updating module 
comprises tools for calculating a moving average over a time to account for events occurring at 
unexpected times. 

40. (Original) The system of claim 34, wherein the abnormality detection 
module determines if monitored system parameters are above an upper threshold or below a 
lower threshold. 

41. (Original) The method of claim 34, wherein the abnormality detection 
module includes a mechanism for calculating upper and lower threshold limits based on jitter 
offset. 

42. (currently amended) A method for distinguishing between normal and 
abnormal behavior during a process, the method comprising: 

monitoring a system parameter; 

converting a numeric data stream representative of the monitored system 
parameter to a state for the process; 

distinguishing between normal and abnormal behavior based on the 
state[[.]L 

wherein the process is related to usage of networked computing devices in 
a datacenter, 
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wherein the system parameter includes at least one of a usage variable, 
utilization, an error, and turn around time, and 

wherein distinguishing between normal and abnormal behavior includes 
utilizing time sensitive averaging to account for variation in a business cycle. 

43. (Original) The method of claim 42, further comprising converting the 
numeric data streams to multiple sub-states. 

44. (Original) The method of claim 42, further comprising determining a root 
cause of an abnormality based on the state. 
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